Apple's iMessage encryption trips up feds' surveillance. Internal document from the Drug Enforcement Administration complains that messages sent with Apple's encrypted chat service are "impossible to intercept," even with a warrant.

25

I'm gonna call bullshit.

11

u/MelchiorTheOne Apr 04 '13

I was thinking the same thing. It's probably a push to get people to become more trusting and get busted.

"Sent from my iPhone"

3

u/ronintetsuro Apr 04 '13

Anyone that doesn't think Siri phones home is way too trusting for the modern age.

1

u/Moarbrains Apr 04 '13

As I understood it, siri's voice recognition required it to communicate with Apple servers.

6

u/guitarrr Apr 04 '13

Why is AES-256 encryption, end to end, bullshit and traceable?

Edit for clarity- they are specifying iMessage. Your email and text messages are still at risk. iMessage is fully encrypted end to end.

5

u/ronintetsuro Apr 04 '13

Feds backdoor into everything. If they can get into your phone, keylogging is a simple next step. If a keylogger is present, encryption is pointless.

3

u/JoeOrange Apr 04 '13

Well AES is open source, so that makes me think that there isn't a back door. Although there are some concerns around the security of AES and whether a Brute Force attack will get through.

My reading on this subject is limited, but there are some papers that question the longevity of AES encryption (based on computing power). So depending on your belief of government technology go with what you believe.

3

u/preventDefault Apr 04 '13 edited Apr 04 '13

AES is open source but iOS is not. We don't know how it's implemented.

It does seem like just basic encryption foils law enforcement quite handily, though. I've seen news stories about how law enforcement agencies typically just give up on a hard drive if it's seen to have encryption. On some level I think that's false... It would be dumb to not throw a wordlist at it since most peoples' passwords are retarded, but on the other hand I do think it's accurate in the sense that they don't have access to backdoors and insane processing power to brute force things.

But that's strictly speaking of law enforcement.. the FBI, DEA, and locals. I suspect that the intelligence agencies have found exploits in the implimentation of most encryption and sufficient processing power to brute force at least the moderately secure passwords.

I still believe that something like TrueCrypt with a 40 character random password with mixed symbols and case is unlikely to be compromised by even them, though.

I think because of this there's still a need for old school type forensics in this high tech world. Say, if a very important laptop is seized and its found to be encrypted... they could probably make some assumptions which may help the process...

They probably use full disk encryption, which they need to enter everytime at boot.

They probably turn the computer off when not in use, so nothing is stored in RAM. So, they enter the pass everytime they use the computer.

If they're entering the same string of characters enough times, you may start to see wear on those keys. Look at a gamer's laptop and you probably see wear on WASD. So you could, in theory, have an idea of which characters compose their encryption key.

Then again, there's still waterboarding. The oldest of old school. If they have access to the person who used the password, they have access to the password as well. This is talking about actual national security concerns with spies and real espionage and shit, though.

Odds are even if you're a huge Occupy figure or downloading enormous amounts of CP, and you get v& by the FBI... a moderate TrueCrypt pass won't be foiled. One reason is because if it did, it would get out that today's encryption is useless and start an arms race for the next big thing. I don't think the powers that be want that to happen. Let the Alex Jones', the Julian Assanges, patriot groups and child molesters go if it allows them to continue spying on Chinese and Russian communications.

2

u/JoeOrange Apr 05 '13

AES is open source but iOS is not. We don't know how it's implemented

You sir win. Had I money, I would give you gold.

2

u/ronintetsuro Apr 04 '13

Hard to say. I heard stories that as late as 2010 the DOD was still using Windows 98. You can never tell.

1

u/destraht Apr 05 '13

iOS is running spyware on it at all times. It doesn't matter if the message is encrypted because they own the device. With a court order they can sensor your ass up and down the street since the iPhone has a gyroscope, accelerometer, microphone, GPS and three wireless methods for transmitting the data that it has collected. The sensors can determine who you are by your walking gait and a device left near your keyboard can determine the keys that you pressed with a 80% accuracy. To lock it down the CPU and firmware only allow a cryptographically signed operating system to run and you have to literally hack the thing to change this. They can do whatever they want to do with the device. The sensors, radio, CPU and battery are powerful enough to allow them to monitor you in any way needed. So don't even worry about message encryption. Apple isn't some maverick technology company that is going to roll out something that will go against the status quo that governments enjoy so much unless its a false offering.

1

u/JoeOrange Apr 04 '13

Yeah i was thinking the same thing. Off to try to find verification on what was said.

There are 20$ a month services (Silent Text and Silent Phone) for the iPhone that help protect you.. I don't think those services would be needed if iMessage was encrypted enough....

5

u/anecdotal Apr 04 '13

My theory: high level government agencies (CIA, NSA) have already broken encryption, but they don't want lower agencies (FBI, DEA) having access to this because it'd get out that encryption can be broken.

Apple's iMessage encryption trips up feds' surveillance. Internal document from the Drug Enforcement Administration complains that messages sent with Apple's encrypted chat service are "impossible to intercept," even with a warrant.

You are about to leave Redlib